> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/configuration-review.md).

# Configuration Review

Configuration Review is the process of assessing security settings against industry best practices to identify misconfigurations, reduce attack surface, and improve an organization's security posture.

Unlike vulnerability scanning, configuration reviews focus on whether systems are securely configured according to established standards rather than identifying software vulnerabilities.

Common issues include:

* Weak authentication
* Excessive permissions
* Publicly accessible resources
* Missing encryption
* Insecure network exposure
* Poor logging and monitoring
* Default configurations

***

### CIS Benchmarks

The Center for Internet Security (CIS) Benchmarks are consensus-based security configuration standards developed by cybersecurity professionals, vendors, government agencies, and industry experts.

CIS Benchmarks provide:

* Secure configuration recommendations
* Prioritised implementation guidance
* Risk reduction recommendations
* Compliance mapping
* Vendor-specific hardening guidance

Reference:

{% embed url="<https://www.cisecurity.org/cis-benchmarks>" %}